Privacy policy
tcg-suriname.sr is a community noticeboard where collectors in Suriname post the trading cards they want to sell, trade or find. This policy covers the website and the tcg-suriname.sr app for iOS and Android. In short: we collect only what the noticeboard needs to work, we don't sell it, we show no ads, and you can delete your account at any time.
What you give us
- Your email address, to sign you in, confirm your account and reset your password. It is never shown to other members.
- Your password, which is stored only as a one-way hash. We can't read it.
- Your display name and, if you choose, where you are, a short bio and a WhatsApp number. The name, location and bio make up your public profile. A WhatsApp number is optional: if you add one, it is shown with every card you post, but only to members who are logged in and have confirmed their email address.
- The cards you post: titles, descriptions, prices, condition and photos. These are public. Before a photo is stored, its hidden metadata is removed, including any GPS location your camera recorded.
- Your watchlist, the cards you tap the eye on. Only you can see it, and the poster is never told.
- The messages you send to other members on the site. They are stored on our server so that you and the member you're writing to can both read them, and no one else can see them on the site or in the app. When someone writes to you, we email you that a message is waiting, without its text, and only once until you've read it.
What is collected automatically
- A sign-in session. On the website this is a single cookie that keeps you logged in for up to 30 days. In the app it is kept in your phone's secure storage. It is needed for the site to work and is not used for tracking.
- Your language and light or dark mode choice, saved on your own device only.
- Your IP address, which our server and Cloudflare (which sits in front of the site to keep it fast and fend off attacks) see with every request. We use it briefly, in memory, to stop abuse such as repeated login attempts. It is not stored with your account.
- Visit statistics on the website, through Plausible Analytics, which we host ourselves. It uses no cookies, doesn't identify you, and the data stays on our own servers. The app contains no analytics at all.
What the app asks permission for
The camera and your photo library, only when you choose to add a photo of a card you're posting. Only the photos you pick are uploaded. The app has no ads, doesn't use your phone's advertising ID, and contains no third-party tracking or analytics code.
Who can see your information
- Everyone, including search engines: your display name, location and bio, and the cards you post with their photos.
- Members who are logged in and have confirmed their email address: your WhatsApp number, if you added one, so they can message you about a card. It is never shown to visitors or search engines.
- You and the member you're writing to: the messages between you.
- Only you: your email address, your watchlist and your settings.
- Our administrators can see account details where they need to, to run and moderate the site.
We don't sell or rent your information, and we don't share it with advertisers.
Services that help us run the site
- Cloudflare, which carries traffic between you and our server.
- An email delivery service, which sends the confirmation, password reset and new message emails to your address.
- When you search the card catalog while posting a card, the card pictures load directly from the sites that publish them (pkmncards.com, pokemon-card.com and pokemonkorea.co.kr), which see your IP address as any website would.
- If you contact a member on WhatsApp rather than by message, what you say there is between you, them and WhatsApp, under WhatsApp's own privacy policy.
How long we keep it
Your account, your cards and your messages are kept until you delete your account or the cards. Sign-in sessions expire after 30 days, confirmation links after 24 hours and password reset links after 1 hour. When you delete your account it is gone from the site straight away. Copies in our backups are deleted as the backups roll over, within 30 days.
Deleting your account
You can delete your account yourself at any time: on the website under Settings → Delete account, or in the app under Account → Delete account. You'll be asked for your password. This immediately removes your profile, every card you've posted with its photos, your watchlist, your conversations and your sign-in sessions. A conversation is deleted for the other member too, since half of it was yours.
If you can't sign in, email [email protected] from the address on your account and we'll delete it for you.
Your rights
You can see and change your profile in Settings at any time. To get a copy of your data, change your email address, or ask anything about how your information is used, email [email protected].
Children
tcg-suriname.sr is not meant for children under 13, and they should not create an account. If you think a child under 13 has an account, email [email protected] and we'll remove it.
Security
The website and the app only talk over encrypted HTTPS connections. Passwords and sign-in tokens are stored as hashes, never in plain text. No system is perfectly secure, but we take reasonable care to protect what you give us.
Changes to this policy
When this policy changes, the date at the top of this page changes with it.
Contact
Questions or requests about your privacy: [email protected]